cd9e0e4355
the on-merge fixer now runs npm run fix plus the registered lint fixers (scripts/lints/run.py --fix). two-job security split unchanged: unprivileged patch generation, privileged patch apply, bot branch renamed bot/js-autofix -> bot/autofix. the patch guard's allow-list is now derived — JS/TS/JSON sources for npm run fix plus each lint's declared fix_touches globs via --print-fix-globs — instead of a hardcoded extension regex. per-lint attribution (a fixer writing a file only another lint's globs allow) is enforced inside run.py --fix, which fails the job before a patch is produced; the workflow guard is the coarse second layer. paths filter dropped: lint inputs span the whole tree and the run exits with an empty patch when there's nothing to fix. still no schedule trigger — merges to main are the clock. |
||
|---|---|---|
| .. | ||
| assemble_review_comment.py | ||
| classify_changes.py | ||
| e2e_screenshot_status.py | ||
| emit_review_status.py | ||
| list_os_marked_tests.py | ||
| live_comment.py | ||
| lockfile_diff.py | ||
| publish_e2e_evidence.py | ||
| test_install_ps1_path_migration.ps1 | ||
| timings_report.py | ||